From 40dddd3998bc9aef1bb2ec6b563ab02485765c4d Mon Sep 17 00:00:00 2001
From: Lyle Schemmerling <lshem16@gmail.com>
Date: Tue, 24 Jun 2025 17:12:37 -0600
Subject: [PATCH 1/4] update clients

---
 .../io/fusionauth/domain/Application.cs       |  2 +
 .../domain/UniversalApplicationTenant.cs      | 36 ++++++++++++++++++
 .../domain/UniversalConfiguration.cs          | 37 +++++++++++++++++++
 .../domain/oauth2/OAuthErrorReason.cs         |  2 +
 .../domain/reactor/ReactorStatus.cs           |  4 ++
 5 files changed, 81 insertions(+)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
index 5e2aa0be..166ca9e5 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
@@ -79,6 +79,8 @@ public class Application {
 
     public Guid? themeId;
 
+    public UniversalConfiguration universalConfiguration;
+
     public RegistrationUnverifiedOptions unverified;
 
     public Guid? verificationEmailTemplateId;
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
new file mode 100644
index 00000000..00b449cb
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain
+{
+
+  /**
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenant {
+
+    public Guid? tenantId;
+
+    public UniversalApplicationTenant with(Action<UniversalApplicationTenant> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
new file mode 100644
index 00000000..788b0809
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain
+{
+
+  public class UniversalConfiguration {
+
+    public List<UniversalApplicationTenant> applicationTenants;
+
+    public bool? global;
+
+    public bool? universal;
+
+    public UniversalConfiguration with(Action<UniversalConfiguration> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/oauth2/OAuthErrorReason.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/oauth2/OAuthErrorReason.cs
index 52adac90..883818c3 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/oauth2/OAuthErrorReason.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/oauth2/OAuthErrorReason.cs
@@ -50,6 +50,7 @@ public enum OAuthErrorReason {
         invalid_target_entity_scope, 
         invalid_entity_permission_scope, 
         invalid_user_id, 
+        invalid_tenant_id, 
         grant_type_disabled, 
         missing_client_id, 
         missing_client_secret, 
@@ -65,6 +66,7 @@ public enum OAuthErrorReason {
         missing_user_code, 
         missing_user_id, 
         missing_verification_uri, 
+        missing_tenant_id, 
         login_prevented, 
         not_licensed, 
         user_code_expired, 
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
index 6cc92a34..ad26fbcd 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/reactor/ReactorStatus.cs
@@ -56,10 +56,14 @@ public class ReactorStatus {
 
     public bool? licensed;
 
+    public ReactorFeatureStatus organizationAdminApplication;
+
     public ReactorFeatureStatus scimServer;
 
     public ReactorFeatureStatus threatDetection;
 
+    public ReactorFeatureStatus universalApplication;
+
     public ReactorFeatureStatus webAuthn;
 
     public ReactorFeatureStatus webAuthnPlatformAuthenticators;

From e1132d8a03432a3ede5287505609a03d073ef3ce Mon Sep 17 00:00:00 2001
From: Lyle Schemmerling <lshem16@gmail.com>
Date: Thu, 26 Jun 2025 16:41:36 -0600
Subject: [PATCH 2/4] add the application-tenant api and move it out of the
 application object

---
 .../domain/UniversalApplicationTenant.cs      |   2 +
 .../domain/UniversalConfiguration.cs          |   2 -
 .../api/UniversalApplicationTenantsRequest.cs |  37 ++++++
 .../UniversalApplicationTenantsResponse.cs    |  37 ++++++
 .../src/io/fusionauth/FusionAuthClient.cs     |  43 +++++++
 .../src/io/fusionauth/FusionAuthSyncClient.cs |  20 ++++
 .../src/io/fusionauth/IFusionAuthClient.cs    | 106 ++++++++++++++++++
 7 files changed, 245 insertions(+), 2 deletions(-)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
index 00b449cb..75e4d829 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
@@ -26,6 +26,8 @@ namespace io.fusionauth.domain
    */
   public class UniversalApplicationTenant {
 
+    public Guid? applicationId;
+
     public Guid? tenantId;
 
     public UniversalApplicationTenant with(Action<UniversalApplicationTenant> action) {
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
index 788b0809..64d38449 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
@@ -23,8 +23,6 @@ namespace io.fusionauth.domain
 
   public class UniversalConfiguration {
 
-    public List<UniversalApplicationTenant> applicationTenants;
-
     public bool? global;
 
     public bool? universal;
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
new file mode 100644
index 00000000..9fafd295
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantsRequest {
+
+    public List<UniversalApplicationTenant> applicationTenants;
+
+    public UniversalApplicationTenantsRequest with(Action<UniversalApplicationTenantsRequest> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs
new file mode 100644
index 00000000..a9dd3a4b
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantsResponse {
+
+    public List<UniversalApplicationTenant> applicationTenants;
+
+    public UniversalApplicationTenantsResponse with(Action<UniversalApplicationTenantsResponse> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index 58e38a19..97c4a8b6 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -483,6 +483,17 @@ public Task<ClientResponse<ThemeResponse>> CreateThemeAsync(Guid? themeId, Theme
           .goAsync<ThemeResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<UniversalApplicationTenantsResponse>> CreateUniversalApplicationTenantsAsync(Guid? applicationId, UniversalApplicationTenantsRequest request) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment(applicationId)
+          .withUriSegment("application-tenant")
+          .withJSONBody(request)
+          .withMethod("Post")
+          .goAsync<UniversalApplicationTenantsResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserResponse>> CreateUserAsync(Guid? userId, UserRequest request) {
       return buildClient()
@@ -858,6 +869,28 @@ public Task<ClientResponse<RESTVoid>> DeleteThemeAsync(Guid? themeId) {
           .goAsync<RESTVoid>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? tenantId) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment(applicationId)
+          .withUriSegment("application-tenant")
+          .withUriSegment(tenantId)
+          .withMethod("Delete")
+          .goAsync<RESTVoid>();
+    }
+
+    /// <inheritdoc/>
+    public Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantsAsync(Guid? applicationId, List<string> tenantIds) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment(applicationId)
+          .withUriSegment("application-tenant")
+          .withParameter("tenantIds", tenantIds)
+          .withMethod("Delete")
+          .goAsync<RESTVoid>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<RESTVoid>> DeleteUserAsync(Guid? userId) {
       return buildClient()
@@ -2387,6 +2420,16 @@ public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsyn
           .goAsync<TwoFactorStatusResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<UniversalApplicationTenantsResponse>> RetrieveUniversalApplicationTenantsAsync(Guid? applicationId) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment(applicationId)
+          .withUriSegment("application-tenant")
+          .withMethod("Get")
+          .goAsync<UniversalApplicationTenantsResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserResponse>> RetrieveUserAsync(Guid? userId) {
       return buildClient()
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index ab037f38..b7d94b4e 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -250,6 +250,11 @@ public ClientResponse<ThemeResponse> CreateTheme(Guid? themeId, ThemeRequest req
       return client.CreateThemeAsync(themeId, request).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<UniversalApplicationTenantsResponse> CreateUniversalApplicationTenants(Guid? applicationId, UniversalApplicationTenantsRequest request) {
+      return client.CreateUniversalApplicationTenantsAsync(applicationId, request).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserResponse> CreateUser(Guid? userId, UserRequest request) {
       return client.CreateUserAsync(userId, request).GetAwaiter().GetResult();
@@ -446,6 +451,16 @@ public ClientResponse<RESTVoid> DeleteTheme(Guid? themeId) {
       return client.DeleteThemeAsync(themeId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? tenantId) {
+      return client.DeleteUniversalApplicationTenantAsync(applicationId, tenantId).GetAwaiter().GetResult();
+    }
+
+    /// <inheritdoc/>
+    public ClientResponse<RESTVoid> DeleteUniversalApplicationTenants(Guid? applicationId, List<string> tenantIds) {
+      return client.DeleteUniversalApplicationTenantsAsync(applicationId, tenantIds).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<RESTVoid> DeleteUser(Guid? userId) {
       return client.DeleteUserAsync(userId).GetAwaiter().GetResult();
@@ -1247,6 +1262,11 @@ public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? use
       return client.RetrieveTwoFactorStatusAsync(userId, applicationId, twoFactorTrustId).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<UniversalApplicationTenantsResponse> RetrieveUniversalApplicationTenants(Guid? applicationId) {
+      return client.RetrieveUniversalApplicationTenantsAsync(applicationId).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserResponse> RetrieveUser(Guid? userId) {
       return client.RetrieveUserAsync(userId).GetAwaiter().GetResult();
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index d9643e07..fc556733 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -608,6 +608,20 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<ThemeResponse>> CreateThemeAsync(Guid? themeId, ThemeRequest request);
 
+    /// <summary>
+    /// Adds the application tenants for universal applications.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+    /// <param name="request"> The request object that contains all the information used to create the Entity.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<UniversalApplicationTenantsResponse>> CreateUniversalApplicationTenantsAsync(Guid? applicationId, UniversalApplicationTenantsRequest request);
+
     /// <summary>
     /// Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
     /// This is an asynchronous method.
@@ -1140,6 +1154,34 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<RESTVoid>> DeleteThemeAsync(Guid? themeId);
 
+    /// <summary>
+    /// Removes the specified tenant from the universal application tenants list.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+    /// <param name="tenantId"> The Id of the tenant to delete from the universal application tenants list.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? tenantId);
+
+    /// <summary>
+    /// Removes the specified tenants from the universal application tenants list.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="applicationId"> The Id of the universal application that the tenants are linked to.</param>
+    /// <param name="tenantIds"> The Ids of the tenants to delete from the universal application tenants list.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantsAsync(Guid? applicationId, List<string> tenantIds);
+
     /// <summary>
     /// Deletes the user for the given Id. This permanently deletes all information, metrics, reports and data associated
     /// with the user.
@@ -3368,6 +3410,19 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsync(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+    /// <summary>
+    /// Retrieves the application tenants for universal applications.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<UniversalApplicationTenantsResponse>> RetrieveUniversalApplicationTenantsAsync(Guid? applicationId);
+
     /// <summary>
     /// Retrieves the user for the given Id.
     /// This is an asynchronous method.
@@ -5525,6 +5580,19 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<ThemeResponse> CreateTheme(Guid? themeId, ThemeRequest request);
 
+   /// <summary>
+   /// Adds the application tenants for universal applications.
+   /// </summary>
+   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+   /// <param name="request"> The request object that contains all the information used to create the Entity.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<UniversalApplicationTenantsResponse> CreateUniversalApplicationTenants(Guid? applicationId, UniversalApplicationTenantsRequest request);
+
    /// <summary>
    /// Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
    /// </summary>
@@ -6018,6 +6086,32 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<RESTVoid> DeleteTheme(Guid? themeId);
 
+   /// <summary>
+   /// Removes the specified tenant from the universal application tenants list.
+   /// </summary>
+   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+   /// <param name="tenantId"> The Id of the tenant to delete from the universal application tenants list.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? tenantId);
+
+   /// <summary>
+   /// Removes the specified tenants from the universal application tenants list.
+   /// </summary>
+   /// <param name="applicationId"> The Id of the universal application that the tenants are linked to.</param>
+   /// <param name="tenantIds"> The Ids of the tenants to delete from the universal application tenants list.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<RESTVoid> DeleteUniversalApplicationTenants(Guid? applicationId, List<string> tenantIds);
+
    /// <summary>
    /// Deletes the user for the given Id. This permanently deletes all information, metrics, reports and data associated
    /// with the user.
@@ -8086,6 +8180,18 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
+   /// <summary>
+   /// Retrieves the application tenants for universal applications.
+   /// </summary>
+   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<UniversalApplicationTenantsResponse> RetrieveUniversalApplicationTenants(Guid? applicationId);
+
    /// <summary>
    /// Retrieves the user for the given Id.
    /// </summary>

From 755810c7a3e86f5c2b0d9e02a8540ca8b8e8d6d6 Mon Sep 17 00:00:00 2001
From: Lyle Schemmerling <lshem16@gmail.com>
Date: Mon, 7 Jul 2025 15:14:16 -0600
Subject: [PATCH 3/4] separate out the universal config and update clients

---
 .../io/fusionauth/domain/Application.cs       |  2 +-
 .../domain/UniversalApplicationTenant.cs      | 10 ++
 .../domain/UniversalConfiguration.cs          | 35 -------
 .../api/UniversalApplicationTenantsRequest.cs | 37 -------
 .../UniversalApplicationTenantsResponse.cs    | 37 -------
 .../src/io/fusionauth/FusionAuthClient.cs     | 41 ++++++--
 .../src/io/fusionauth/FusionAuthSyncClient.cs | 22 +++--
 .../src/io/fusionauth/IFusionAuthClient.cs    | 98 +++++++++++++++----
 8 files changed, 138 insertions(+), 144 deletions(-)
 delete mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
 delete mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
 delete mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
index 166ca9e5..9fbe9bd8 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/Application.cs
@@ -79,7 +79,7 @@ public class Application {
 
     public Guid? themeId;
 
-    public UniversalConfiguration universalConfiguration;
+    public UniversalApplicationConfiguration universalConfiguration;
 
     public RegistrationUnverifiedOptions unverified;
 
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
index 75e4d829..57e9d50e 100644
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationTenant.cs
@@ -22,12 +22,22 @@ namespace io.fusionauth.domain
 {
 
   /**
+   * An object that represents the mapping between a Universal Application and a Tenant.
+   *
    * @author Lyle Schemmerling
    */
   public class UniversalApplicationTenant {
 
     public Guid? applicationId;
 
+    public IDictionary<string, object> data;
+
+    public Guid? id;
+
+    public DateTimeOffset? insertInstant;
+
+    public DateTimeOffset? lastUpdateInstant;
+
     public Guid? tenantId;
 
     public UniversalApplicationTenant with(Action<UniversalApplicationTenant> action) {
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
deleted file mode 100644
index 64d38449..00000000
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalConfiguration.cs
+++ /dev/null
@@ -1,35 +0,0 @@
-/*
- * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-
-using System.Collections.Generic;
-using System;
-
-namespace io.fusionauth.domain
-{
-
-  public class UniversalConfiguration {
-
-    public bool? global;
-
-    public bool? universal;
-
-    public UniversalConfiguration with(Action<UniversalConfiguration> action) {
-      action(this);
-      return this;
-    }
-  }
-}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
deleted file mode 100644
index 9fafd295..00000000
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsRequest.cs
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-
-using io.fusionauth.domain;
-using System.Collections.Generic;
-using System;
-
-namespace io.fusionauth.domain.api
-{
-
-  /**
-   * @author Lyle Schemmerling
-   */
-  public class UniversalApplicationTenantsRequest {
-
-    public List<UniversalApplicationTenant> applicationTenants;
-
-    public UniversalApplicationTenantsRequest with(Action<UniversalApplicationTenantsRequest> action) {
-      action(this);
-      return this;
-    }
-  }
-}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs
deleted file mode 100644
index a9dd3a4b..00000000
--- a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantsResponse.cs
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-
-using io.fusionauth.domain;
-using System.Collections.Generic;
-using System;
-
-namespace io.fusionauth.domain.api
-{
-
-  /**
-   * @author Lyle Schemmerling
-   */
-  public class UniversalApplicationTenantsResponse {
-
-    public List<UniversalApplicationTenant> applicationTenants;
-
-    public UniversalApplicationTenantsResponse with(Action<UniversalApplicationTenantsResponse> action) {
-      action(this);
-      return this;
-    }
-  }
-}
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
index 97c4a8b6..b5cf2d54 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthClient.cs
@@ -484,14 +484,15 @@ public Task<ClientResponse<ThemeResponse>> CreateThemeAsync(Guid? themeId, Theme
     }
 
     /// <inheritdoc/>
-    public Task<ClientResponse<UniversalApplicationTenantsResponse>> CreateUniversalApplicationTenantsAsync(Guid? applicationId, UniversalApplicationTenantsRequest request) {
+    public Task<ClientResponse<UniversalApplicationTenantResponse>> CreateUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request) {
       return buildClient()
           .withUri("/api/application")
           .withUriSegment(applicationId)
-          .withUriSegment("application-tenant")
+          .withUriSegment("universal-application-tenant")
+          .withUriSegment(universalApplicationTenantId)
           .withJSONBody(request)
           .withMethod("Post")
-          .goAsync<UniversalApplicationTenantsResponse>();
+          .goAsync<UniversalApplicationTenantResponse>();
     }
 
     /// <inheritdoc/>
@@ -870,12 +871,12 @@ public Task<ClientResponse<RESTVoid>> DeleteThemeAsync(Guid? themeId) {
     }
 
     /// <inheritdoc/>
-    public Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? tenantId) {
+    public Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId) {
       return buildClient()
           .withUri("/api/application")
           .withUriSegment(applicationId)
-          .withUriSegment("application-tenant")
-          .withUriSegment(tenantId)
+          .withUriSegment("universal-application-tenant")
+          .withUriSegment(universalApplicationTenantId)
           .withMethod("Delete")
           .goAsync<RESTVoid>();
     }
@@ -2421,13 +2422,14 @@ public Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsyn
     }
 
     /// <inheritdoc/>
-    public Task<ClientResponse<UniversalApplicationTenantsResponse>> RetrieveUniversalApplicationTenantsAsync(Guid? applicationId) {
+    public Task<ClientResponse<UniversalApplicationTenantResponse>> RetrieveUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId) {
       return buildClient()
           .withUri("/api/application")
           .withUriSegment(applicationId)
           .withUriSegment("application-tenant")
+          .withUriSegment(universalApplicationTenantId)
           .withMethod("Get")
-          .goAsync<UniversalApplicationTenantsResponse>();
+          .goAsync<UniversalApplicationTenantResponse>();
     }
 
     /// <inheritdoc/>
@@ -2943,6 +2945,17 @@ public Task<ClientResponse<ThemeSearchResponse>> SearchThemesAsync(ThemeSearchRe
           .goAsync<ThemeSearchResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<UniversalApplicationTenantSearchResponse>> SearchUniversalApplicationTenantsAsync(UniversalApplicationTenantSearchRequest request) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment("universal-application-tenant")
+          .withUriSegment("search")
+          .withJSONBody(request)
+          .withMethod("Post")
+          .goAsync<UniversalApplicationTenantSearchResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserCommentSearchResponse>> SearchUserCommentsAsync(UserCommentSearchRequest request) {
       return buildClient()
@@ -3392,6 +3405,18 @@ public Task<ClientResponse<ThemeResponse>> UpdateThemeAsync(Guid? themeId, Theme
           .goAsync<ThemeResponse>();
     }
 
+    /// <inheritdoc/>
+    public Task<ClientResponse<UniversalApplicationTenantResponse>> UpdateUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request) {
+      return buildClient()
+          .withUri("/api/application")
+          .withUriSegment(applicationId)
+          .withUriSegment("universal-application-tenant")
+          .withUriSegment(universalApplicationTenantId)
+          .withJSONBody(request)
+          .withMethod("Put")
+          .goAsync<UniversalApplicationTenantResponse>();
+    }
+
     /// <inheritdoc/>
     public Task<ClientResponse<UserResponse>> UpdateUserAsync(Guid? userId, UserRequest request) {
       return buildClient()
diff --git a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
index b7d94b4e..3baeb1ea 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/FusionAuthSyncClient.cs
@@ -251,8 +251,8 @@ public ClientResponse<ThemeResponse> CreateTheme(Guid? themeId, ThemeRequest req
     }
 
     /// <inheritdoc/>
-    public ClientResponse<UniversalApplicationTenantsResponse> CreateUniversalApplicationTenants(Guid? applicationId, UniversalApplicationTenantsRequest request) {
-      return client.CreateUniversalApplicationTenantsAsync(applicationId, request).GetAwaiter().GetResult();
+    public ClientResponse<UniversalApplicationTenantResponse> CreateUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request) {
+      return client.CreateUniversalApplicationTenantAsync(applicationId, universalApplicationTenantId, request).GetAwaiter().GetResult();
     }
 
     /// <inheritdoc/>
@@ -452,8 +452,8 @@ public ClientResponse<RESTVoid> DeleteTheme(Guid? themeId) {
     }
 
     /// <inheritdoc/>
-    public ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? tenantId) {
-      return client.DeleteUniversalApplicationTenantAsync(applicationId, tenantId).GetAwaiter().GetResult();
+    public ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId) {
+      return client.DeleteUniversalApplicationTenantAsync(applicationId, universalApplicationTenantId).GetAwaiter().GetResult();
     }
 
     /// <inheritdoc/>
@@ -1263,8 +1263,8 @@ public ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? use
     }
 
     /// <inheritdoc/>
-    public ClientResponse<UniversalApplicationTenantsResponse> RetrieveUniversalApplicationTenants(Guid? applicationId) {
-      return client.RetrieveUniversalApplicationTenantsAsync(applicationId).GetAwaiter().GetResult();
+    public ClientResponse<UniversalApplicationTenantResponse> RetrieveUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId) {
+      return client.RetrieveUniversalApplicationTenantAsync(applicationId, universalApplicationTenantId).GetAwaiter().GetResult();
     }
 
     /// <inheritdoc/>
@@ -1542,6 +1542,11 @@ public ClientResponse<ThemeSearchResponse> SearchThemes(ThemeSearchRequest reque
       return client.SearchThemesAsync(request).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<UniversalApplicationTenantSearchResponse> SearchUniversalApplicationTenants(UniversalApplicationTenantSearchRequest request) {
+      return client.SearchUniversalApplicationTenantsAsync(request).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserCommentSearchResponse> SearchUserComments(UserCommentSearchRequest request) {
       return client.SearchUserCommentsAsync(request).GetAwaiter().GetResult();
@@ -1776,6 +1781,11 @@ public ClientResponse<ThemeResponse> UpdateTheme(Guid? themeId, ThemeRequest req
       return client.UpdateThemeAsync(themeId, request).GetAwaiter().GetResult();
     }
 
+    /// <inheritdoc/>
+    public ClientResponse<UniversalApplicationTenantResponse> UpdateUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request) {
+      return client.UpdateUniversalApplicationTenantAsync(applicationId, universalApplicationTenantId, request).GetAwaiter().GetResult();
+    }
+
     /// <inheritdoc/>
     public ClientResponse<UserResponse> UpdateUser(Guid? userId, UserRequest request) {
       return client.UpdateUserAsync(userId, request).GetAwaiter().GetResult();
diff --git a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
index fc556733..4ec5ca2c 100644
--- a/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
+++ b/fusionauth-netcore-client/src/io/fusionauth/IFusionAuthClient.cs
@@ -612,15 +612,16 @@ public interface IFusionAuthAsyncClient {
     /// Adds the application tenants for universal applications.
     /// This is an asynchronous method.
     /// </summary>
-    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
-    /// <param name="request"> The request object that contains all the information used to create the Entity.</param>
+    /// <param name="applicationId"> The Id of the application that the universal application tenant belongs to.</param>
+    /// <param name="universalApplicationTenantId"> (Optional) The Id of the universal application tenant.</param>
+    /// <param name="request"> The request object that contains all the information used to create the UniversalApplicationTenants.</param>
     /// <returns>
     /// When successful, the response will contain the log of the action. If there was a validation error or any
     /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
     /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
     /// IOException.
     /// </returns>
-    Task<ClientResponse<UniversalApplicationTenantsResponse>> CreateUniversalApplicationTenantsAsync(Guid? applicationId, UniversalApplicationTenantsRequest request);
+    Task<ClientResponse<UniversalApplicationTenantResponse>> CreateUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request);
 
     /// <summary>
     /// Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
@@ -1155,18 +1156,18 @@ public interface IFusionAuthAsyncClient {
     Task<ClientResponse<RESTVoid>> DeleteThemeAsync(Guid? themeId);
 
     /// <summary>
-    /// Removes the specified tenant from the universal application tenants list.
+    /// Deletes the universal application tenant.
     /// This is an asynchronous method.
     /// </summary>
-    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
-    /// <param name="tenantId"> The Id of the tenant to delete from the universal application tenants list.</param>
+    /// <param name="applicationId"> The Id of the application that the UniversalApplicationTenant belongs to.</param>
+    /// <param name="universalApplicationTenantId"> The Id of the UniversalApplicationTenant to delete.</param>
     /// <returns>
     /// When successful, the response will contain the log of the action. If there was a validation error or any
     /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
     /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
     /// IOException.
     /// </returns>
-    Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? tenantId);
+    Task<ClientResponse<RESTVoid>> DeleteUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId);
 
     /// <summary>
     /// Removes the specified tenants from the universal application tenants list.
@@ -3411,17 +3412,18 @@ public interface IFusionAuthAsyncClient {
     Task<ClientResponse<TwoFactorStatusResponse>> RetrieveTwoFactorStatusAsync(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
     /// <summary>
-    /// Retrieves the application tenants for universal applications.
+    /// Retrieves the universal application tenant.
     /// This is an asynchronous method.
     /// </summary>
-    /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+    /// <param name="applicationId"> The Id of the universal application that tenant is mapped to</param>
+    /// <param name="universalApplicationTenantId"> The Id of the universal application tenant.</param>
     /// <returns>
     /// When successful, the response will contain the log of the action. If there was a validation error or any
     /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
     /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
     /// IOException.
     /// </returns>
-    Task<ClientResponse<UniversalApplicationTenantsResponse>> RetrieveUniversalApplicationTenantsAsync(Guid? applicationId);
+    Task<ClientResponse<UniversalApplicationTenantResponse>> RetrieveUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId);
 
     /// <summary>
     /// Retrieves the user for the given Id.
@@ -4186,6 +4188,19 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<ThemeSearchResponse>> SearchThemesAsync(ThemeSearchRequest request);
 
+    /// <summary>
+    /// Searches universal application tenants for the specified applicationId and with the specified criteria and pagination.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="request"> The search criteria and pagination information.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<UniversalApplicationTenantSearchResponse>> SearchUniversalApplicationTenantsAsync(UniversalApplicationTenantSearchRequest request);
+
     /// <summary>
     /// Searches user comments with the specified criteria and pagination.
     /// This is an asynchronous method.
@@ -4826,6 +4841,21 @@ public interface IFusionAuthAsyncClient {
     /// </returns>
     Task<ClientResponse<ThemeResponse>> UpdateThemeAsync(Guid? themeId, ThemeRequest request);
 
+    /// <summary>
+    /// Adds the application tenants for universal applications.
+    /// This is an asynchronous method.
+    /// </summary>
+    /// <param name="applicationId"> The Id of the application that the UniversalApplicationTenant belongs to.</param>
+    /// <param name="universalApplicationTenantId"> The Id of the universal application tenant.</param>
+    /// <param name="request"> The request object that contains all the information used to create the UniversalApplicationTenant.</param>
+    /// <returns>
+    /// When successful, the response will contain the log of the action. If there was a validation error or any
+    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+    /// IOException.
+    /// </returns>
+    Task<ClientResponse<UniversalApplicationTenantResponse>> UpdateUniversalApplicationTenantAsync(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request);
+
     /// <summary>
     /// Updates the user with the given Id.
     /// This is an asynchronous method.
@@ -5583,15 +5613,16 @@ public interface IFusionAuthSyncClient {
    /// <summary>
    /// Adds the application tenants for universal applications.
    /// </summary>
-   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
-   /// <param name="request"> The request object that contains all the information used to create the Entity.</param>
+   /// <param name="applicationId"> The Id of the application that the universal application tenant belongs to.</param>
+   /// <param name="universalApplicationTenantId"> (Optional) The Id of the universal application tenant.</param>
+   /// <param name="request"> The request object that contains all the information used to create the UniversalApplicationTenants.</param>
    /// <returns>
    /// When successful, the response will contain the log of the action. If there was a validation error or any
    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
    /// IOException.
    /// </returns>
-   ClientResponse<UniversalApplicationTenantsResponse> CreateUniversalApplicationTenants(Guid? applicationId, UniversalApplicationTenantsRequest request);
+   ClientResponse<UniversalApplicationTenantResponse> CreateUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request);
 
    /// <summary>
    /// Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
@@ -6087,17 +6118,17 @@ public interface IFusionAuthSyncClient {
    ClientResponse<RESTVoid> DeleteTheme(Guid? themeId);
 
    /// <summary>
-   /// Removes the specified tenant from the universal application tenants list.
+   /// Deletes the universal application tenant.
    /// </summary>
-   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
-   /// <param name="tenantId"> The Id of the tenant to delete from the universal application tenants list.</param>
+   /// <param name="applicationId"> The Id of the application that the UniversalApplicationTenant belongs to.</param>
+   /// <param name="universalApplicationTenantId"> The Id of the UniversalApplicationTenant to delete.</param>
    /// <returns>
    /// When successful, the response will contain the log of the action. If there was a validation error or any
    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
    /// IOException.
    /// </returns>
-   ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? tenantId);
+   ClientResponse<RESTVoid> DeleteUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId);
 
    /// <summary>
    /// Removes the specified tenants from the universal application tenants list.
@@ -8181,16 +8212,17 @@ public interface IFusionAuthSyncClient {
    ClientResponse<TwoFactorStatusResponse> RetrieveTwoFactorStatus(Guid? userId, Guid? applicationId, string twoFactorTrustId);
 
    /// <summary>
-   /// Retrieves the application tenants for universal applications.
+   /// Retrieves the universal application tenant.
    /// </summary>
-   /// <param name="applicationId"> The Id of the application that the role belongs to.</param>
+   /// <param name="applicationId"> The Id of the universal application that tenant is mapped to</param>
+   /// <param name="universalApplicationTenantId"> The Id of the universal application tenant.</param>
    /// <returns>
    /// When successful, the response will contain the log of the action. If there was a validation error or any
    /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
    /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
    /// IOException.
    /// </returns>
-   ClientResponse<UniversalApplicationTenantsResponse> RetrieveUniversalApplicationTenants(Guid? applicationId);
+   ClientResponse<UniversalApplicationTenantResponse> RetrieveUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId);
 
    /// <summary>
    /// Retrieves the user for the given Id.
@@ -8900,6 +8932,18 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<ThemeSearchResponse> SearchThemes(ThemeSearchRequest request);
 
+   /// <summary>
+   /// Searches universal application tenants for the specified applicationId and with the specified criteria and pagination.
+   /// </summary>
+   /// <param name="request"> The search criteria and pagination information.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<UniversalApplicationTenantSearchResponse> SearchUniversalApplicationTenants(UniversalApplicationTenantSearchRequest request);
+
    /// <summary>
    /// Searches user comments with the specified criteria and pagination.
    /// </summary>
@@ -9494,6 +9538,20 @@ public interface IFusionAuthSyncClient {
    /// </returns>
    ClientResponse<ThemeResponse> UpdateTheme(Guid? themeId, ThemeRequest request);
 
+   /// <summary>
+   /// Adds the application tenants for universal applications.
+   /// </summary>
+   /// <param name="applicationId"> The Id of the application that the UniversalApplicationTenant belongs to.</param>
+   /// <param name="universalApplicationTenantId"> The Id of the universal application tenant.</param>
+   /// <param name="request"> The request object that contains all the information used to create the UniversalApplicationTenant.</param>
+   /// <returns>
+   /// When successful, the response will contain the log of the action. If there was a validation error or any
+   /// other type of error, this will return the Errors object in the response. Additionally, if FusionAuth could not be
+   /// contacted because it is down or experiencing a failure, the response will contain an Exception, which could be an
+   /// IOException.
+   /// </returns>
+   ClientResponse<UniversalApplicationTenantResponse> UpdateUniversalApplicationTenant(Guid? applicationId, Guid? universalApplicationTenantId, UniversalApplicationTenantRequest request);
+
    /// <summary>
    /// Updates the user with the given Id.
    /// </summary>

From fcae243de4671915e3488db4e7431b9c29f346bc Mon Sep 17 00:00:00 2001
From: Lyle Schemmerling <lshem16@gmail.com>
Date: Mon, 7 Jul 2025 15:25:36 -0600
Subject: [PATCH 4/4] add untracked files

---
 .../UniversalApplicationConfiguration.cs      | 38 +++++++++++++++++
 .../api/UniversalApplicationTenantRequest.cs  | 39 ++++++++++++++++++
 .../api/UniversalApplicationTenantResponse.cs | 39 ++++++++++++++++++
 ...UniversalApplicationTenantSearchRequest.cs | 39 ++++++++++++++++++
 ...niversalApplicationTenantSearchResponse.cs | 41 +++++++++++++++++++
 ...niversalApplicationTenantSearchCriteria.cs | 40 ++++++++++++++++++
 6 files changed, 236 insertions(+)
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationConfiguration.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantRequest.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantResponse.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchRequest.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchResponse.cs
 create mode 100644 fusionauth-netcore-client/domain/io/fusionauth/domain/search/UniversalApplicationTenantSearchCriteria.cs

diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationConfiguration.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationConfiguration.cs
new file mode 100644
index 00000000..3c2c2e03
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/UniversalApplicationConfiguration.cs
@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain
+{
+
+  /**
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationConfiguration {
+
+    public bool? global;
+
+    public bool? universal;
+
+    public UniversalApplicationConfiguration with(Action<UniversalApplicationConfiguration> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantRequest.cs
new file mode 100644
index 00000000..c7a23412
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantRequest.cs
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * The request object for creating or updating a Universal Application Tenant.
+   *
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantRequest {
+
+    public UniversalApplicationTenant universalApplicationTenant;
+
+    public UniversalApplicationTenantRequest with(Action<UniversalApplicationTenantRequest> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantResponse.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantResponse.cs
new file mode 100644
index 00000000..34d0a20f
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantResponse.cs
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * The response object for a single Universal Application Tenant.
+   *
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantResponse {
+
+    public UniversalApplicationTenant universalApplicationTenant;
+
+    public UniversalApplicationTenantResponse with(Action<UniversalApplicationTenantResponse> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchRequest.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchRequest.cs
new file mode 100644
index 00000000..e961e0f3
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchRequest.cs
@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain.search;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * The request object with the search criteria for Universal Application Tenants.
+   *
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantSearchRequest {
+
+    public UniversalApplicationTenantSearchCriteria search;
+
+    public UniversalApplicationTenantSearchRequest with(Action<UniversalApplicationTenantSearchRequest> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchResponse.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchResponse.cs
new file mode 100644
index 00000000..3edfba25
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/api/UniversalApplicationTenantSearchResponse.cs
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using io.fusionauth.domain;
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.api
+{
+
+  /**
+   * The response object for Universal Application Tenants search results.
+   *
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantSearchResponse {
+
+    public List<UniversalApplicationTenant> universalApplicationTenants;
+
+    public long? total;
+
+    public UniversalApplicationTenantSearchResponse with(Action<UniversalApplicationTenantSearchResponse> action) {
+      action(this);
+      return this;
+    }
+  }
+}
diff --git a/fusionauth-netcore-client/domain/io/fusionauth/domain/search/UniversalApplicationTenantSearchCriteria.cs b/fusionauth-netcore-client/domain/io/fusionauth/domain/search/UniversalApplicationTenantSearchCriteria.cs
new file mode 100644
index 00000000..a5ded562
--- /dev/null
+++ b/fusionauth-netcore-client/domain/io/fusionauth/domain/search/UniversalApplicationTenantSearchCriteria.cs
@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2018-2023, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+
+using System.Collections.Generic;
+using System;
+
+namespace io.fusionauth.domain.search
+{
+
+  /**
+   * @author Lyle Schemmerling
+   */
+  public class UniversalApplicationTenantSearchCriteria: BaseSearchCriteria {
+
+    public Guid? applicationId;
+
+    public Guid? tenantId;
+
+    public string tenantName;
+
+    public UniversalApplicationTenantSearchCriteria with(Action<UniversalApplicationTenantSearchCriteria> action) {
+      action(this);
+      return this;
+    }
+  }
+}